Hacker News Reader

Comment by londons_explore | Hacker News Reader

If Zoom made clear to users that connections were not secured to the same standards as competitors, and that potentially hundreds of employees could be silently listening in on any call, I think that would have prevented them becoming a leader in video conference tech.

So the right fine here is their entire market cap. That would put them back at square one, which is where an honest competitor would be right now.

View on HN

Not defending them in any way - but don't think security was the primary reason for Zoom taking off. It was stability - it just worked and at the same time competitors didn't.

Everybody used to have Skype and I would have gladly handed over my data to MS if only it would have been able to do stable video calls. It was often a disaster for just 2-way calls, let alone group.

Skype was better before the MS aquisition... and it used to be P2P. It'd be nice if the pre-MS source would leak somehow.

I think you may be viewing history through slightly rose-tinted glasses there - I used pre-MS Skype a lot and it was never anywhere near as reliable as Zoom is and didn't support group video chat at all. And the fact that it was P2P meant that some features that everyone would expect to work these days (offline messages, mobile support) were simply not possible at all.

Or maybe your long term memory is corrupted?

Amen

I'm not sure what would be accomplished if the source leaked. Someone would still need to maintain both the client and now a new set of servers. This would be difficult given that Microsoft would almost certainly use whatever means they could to stop this from happening.

Wasn’t Skype pre-MS P2P, not server based?

Perhaps. But at minimum there would still be some server necessary for discovery purposes.

The client application was also the server application. Clients with good connections which appeared to always be online became super nodes which were the directory "servers" you would connect to. The code base contained a long list of previously known super nodes and would attempt to connect to those on first start. As it ran it would keep syncing the list of close super nodes. There were many hundreds of super nodes, so the odds of all of them changing or going offline were pretty slim.

I imagine some people at Skype probably kept a few instances of Skype running at the office. So they technically hosted a few super nodes, but it wasn't necessarily that they were running some vastly different server version of the app. It wasn't until Microsoft decided to cut down on the P2P aspect of the app and hardcode only Azure-hosted super nodes into the application that this changed.

Interesting. I didn't realize that Skype was really P2P. Thanks for sharing :)

Isn’t that also how BitTorrent’s DHT works?

https://escargot.log1p.xyz/

Wow. Brings back memories as MSN was the messenger of choice during my college years :)

Fun fact, the original Skype developers also developed the great (for its time) P2P filesharing app/network Kazaa/FastTrack.

> don't think security was the primary reason for Zoom taking off. It was stability

Stability was the main draw, but company IT departments would have had more power to ban it if there were bigger and clearer risks of corporate secrets escaping.

Industrial espionage is real. There are many companies who are concerned about this and take active steps to keep data secret who would likely not have approved zoom use if they'd known e2e encryption wasn't to the level they were told.

Some folks are concerned with more than stability and ease of use.

Once can't just delegate responsibility like that. Any company should enage in some form of due dilligence before procuring software. If there are expecations of privacy then those should be proven by the company procuring the software, not the vendor.

So it's okay that Zoom lied because users should have reverse engineered it to verify that what Zoom said about their own product was true?

No, if a company was really worried they shouldn't have opted for a cloud product with a (partly) Chinese-owned company. A lot of companies go through the trouble of giving their employees (especially management) "throw away" phones and/or computers when they send them to "problematic" places, in particular China, but then they install Zoom for their C-level and middle management executives to use, huh?

But everybody knows C-level and middle-management don't actually know anything or do anything. Have at it! Its like spamming the spammers.

How would you verify e2e encryption on a proprietary protocol? Not every company that cares about privacy has crypto experts on staff. They should have a reasonable expectation that the vendor is telling the truth.

1. Is the software proprietary? Liability, Denied.

You can't. Don't trust, but verify. If a company or individual needs strong privacy, they should verify any encryption claims.

This would mean using only libre/open source software like Jitsu or Linphone, as one could verify the code or higher experts to verify the code.

You know what it's called when you purposefully lie about your products or services to gain an advantage? Fraud.

If this was happenening in any other industry (except fonance?), the perpetrators would be in jail.

It's difficult to imagine a company that cares that much about keeping their video chat data private, but would use any third party service.

That doesn't justify zoom making false claims--I just don't think the companies you're describing would be using zoom.

Or state secrets, or court secrets, or just preventing random zoom admins from watching children in virtual class rooms.

Any company IT department's power to ban something is inversely related to how much it's users want to use it. Also, the videoconference provider stealing company secrets it not part of most companies threat model. Teams and Slack are incredibly popular corporate tools, and neither of them offer this feature. WebEx is the only reasonably popular tool I can think of that supports it, and any security department that cared strongly about E2EE, would be asking questions like "do you perform key escrow" if they were thinking of migrating off something like that.

Why isn’t it? I highly suspect the CCP stole trade secrets with zoom.

Because in order to operate a business (or any organization), you have to at some point decide on a group of service providers and other 3rd parties that you trust. For most organizations, trusting a major videoconferencing vendor is going to be within their risk tolerance. For some organizations (or for some use-cases within organizations) this wouldn't be acceptable (or perhaps trusting Zoom wouldn't be acceptable, where a different vendor might be), but at this point you're starting to stray outside of Zoom's target market and into a set of more specialized requirements.

Defending against sophisticated state-level actors goes even further beyond the requirements of most businesses. Unless you had a specific reason to believe that you were a target of such actors (dealing with national security, or matters of significant national strategic importance), you couldn't justify investing much resource into such defensive measures.

Does it really take that much for a company to be an interesting target for industrial espionage ?

> It was stability - it just worked

Also due to deception, it auto reinstalled on macs until they were caught.

"this software I uninstalled keeps reinstalling itself. oh well, I guess I will have to use it!" said no one ever.

Users were unaware this was happening. "It just worked" because it would install itself in the background unbeknownst to the user, thus obviating the need to take time to install it when needed.

It's much easier to make a stable communication product if you don't need to worry about security and privacy.

Just look at the troubles and hurdles Signal messenger need to overcome to implement some features, while the competition that is not so security focused has them since forever.

and it could be more stable because it didn't implement e2e encryption.

THIS THIS THIS. End users (generally) do not care about security they just need it to work.

That is what was great about zoom. The security becomes important after it works.

It was stability and speed! It uses very little CPU for everything!

They took money from many clients to provide a service.

They did not provide the service the advertised: they provided something much inferior (and that's actually unsuitable for many industries).

It's not really really about "what would clients have done otherwise". It's a matter of giving money back.

If you pay me to write a program, and it only does half of what I promise, wouldn't you want [part of] your money back?

> It was stability - it just worked and at the same time competitors didn't.

This is absolutely huge. We've tried Teams (and I have previously used Webex and Hangouts).

It seems like there is _always_ one person that struggles with other video services. Can't join, video/audio issues, CPU usage, latency, etc. Painful when 10%+ of a meeting is consumed by getting one last, key person trying to fix their issues.

I wish that was true, but in practice I think it wouldn't matter. Zoom was the only one ready with infrastructure, multiple clients, automatic quality adjustment, screen sharing options, scheduling, and many other needed features.

Otherwise we had hangouts/meet with very basic features and jet-taking-off Mac behaviour, chime which is really good but nobody heard of it (Amazon is not interested in that market apparently), Skype which aims for social chat consumers, slack which works only within the org, jitsi, and a thousand of me-too apps with very basic feature set.

Zoom could kick your puppy at the end of each call, and it would likely still be the best choice at the time :-(

Sure, if you don't worry about privacy.

You can care about privacy yet still prioritize not killing your company in a pandemic.

Very few things that are hosted are immune to employee buggery, that’s why companies invest in third party risk management; to assess those risks, which are always material and non-zero and determine if they are within the appetite of the organization.

true. one could just use onsite or p2p tech that avoids using servers beyond handshakes.

"chime which is really good but nobody heard of it"

So there was a competitor after all?

Amazon doesn't seem interested in that app being used by random consumers. There's very few accessible guides around it. It's technically good, but it's not even a competitor as such.

Some reports say the whole video conferencing market, being very optimistic, will reach $50B in 2026 (considering Covid-19 - https://www.gminsights.com/industry-analysis/video-conferenc...)

But Zoom, alone, already has a marketcap of $117.534B (https://finance.yahoo.com/quote/ZM/)

I really think there is an unsustainable distortion happening.

Wild optimism aside, you can sell one or even a thousand ZM shares at approximately the current market price, but you can't sell the entirety of the company at the same price. The pool of buyers is much smaller for such volumes.

I don't really think so. I think we are just moving away from inefficient meetings that are IRL. I would love to see all meetings go remote for many reasons. I think this will stay even once Covid is gone.

The market being $50B means there are $50B of sales to do per year.

Market cap is a multiplier of revenues, easily 10 or 20 for a tech company, that means a $1T market cap to be taken across the videoconference companies.

Wondering how numbers can be so high? Count $10 per month * 12 months in a year * 100 million employees in the US... that is $12B per year going to video software!

Actually, price / earnings (P/E ratio) is typically 10-20 for _any_ company in the S&P 500. When you look at big tech, the numbers are drastically higher:

- AMZN: 92

- GOOG: 34

- FB: 33

- NFLX: 76

- AAPL: 35

- MSFT: 35

Compare this to, say, 3M, at 19, or GM with 17.

edit: incidentally, apparently Zoom's P/E is... 527, which is grossly inflated even for a tech company. Tesla is also in the same category with a P/E of 834.

It is, but markets can stay irrational longer than you can stay liquid to paraphrase somewhat famous quip. I was also one of those people who tried shorting TSLA since I believe they are way overvalued. I agree with you, but the market has spoken.

P/E ratio formula is listed above correctly, however, earnings is earnings per share, not revenue. So the parent's market valuation rationale is whacky.

Side note - Go read about Japan's lost decade and you'll see how dangerously close our (US) current speculative investing environment is to theirs before it fell.

Market cap is the paper value of the company. It has little to do with the market. Zoom’s planned pivot is into boring markets like business VoIP.

Zoom went bananas because they won the space at a point in time that mattered. FaceTime is too proprietary and lacks features due to E2E, WebEx is run by incompetents, Google Meet is hard to use, and Teams is too complex. There’s a thousand other competitors with a few users.

Speculators poured billions into the consort and the valuation went nuts. That could go away in a week.

> I really think there is an unsustainable distortion happening.

Yes, soon any website can have their own videoconferencing using web technology like WebRTC. And implementation will be as simple as running "npm install".

> But Zoom, alone, already has a marketcap of $117.534B

Yes. Zoom having a market cap that's more than half of Intel? Come on now ...

I'll take one good native app over a thousand of crappy websites.

Is it really different from competitors like Cisco (webex, jabber, ...)? A big selling point of all those is phone dial in which can't be done with e2e encryption (the phone gateway run by the operator has to have the keys)

The thing is: Our team doesn't use phone dial-in, haven't even seen the feature so I guess it's not enabled, but still we don't have e2e encryption.

That doesn't make sense.

No doubt their, but GP refered to competitors and in that segment e2e is rare.

Phone dial-in is always a paid addon.

I guess it's the same on Zoom and your company doesn't pay for it.

Their competitors were using the same standard of security.

FaceTime is the big E2E service. Most anything else allows dial in, and is not E2E. Zoom’s sin is bad marketing copy.

> the right fine here is their entire market cap. That would put them back at square one

I don't think Zoom has transgressed anywhere nearly this badly, but even if I did it doesn't make sense to fine any company their entire value unless your goal is simply to destroy them. The company is only worth as much as it is because it is expected to continue as a company, and there would be no way for it to continue if it owed that much money to the government. Unless it was nationalized and run by the government, but I doubt you're proposing that? Which means instead the company liquidates, and its liquidation value is far less than it's value as a business.

A good punishment is government nationalizes it, paying shareholders nothing, then immediately sells those shares back onto the public markets. The government would earn close-ish to the market cap.

Effectively, allow the company to continue as before, but wipe out all shareholders. After all, they are the people who allowed this behaviour. They are the ultimate decision makers.

No, abandoning property rights is not even close to an appropriate punishment, even for those directly responsible for the fraud, let alone for ignorant shareholders.

Totally agree, and this should hold for any kind of illegal growth hacking.

Is this about the audio streams? I imagine that if at any time there are a million video streams happening, and zoom wanted to sneak into 1% of them, it would pretty much need 10000 vCPUs of compute to do that? The current tech scales affordably because only the encoded packets get transmitted between callers (via "selective forwarding units") without needing server-side re-encoding?

edit: That was for video streams. For audio streams, certainly the cpus cost is lower - about 10%.

The processing doesn't need to happen live. Bitstreams can be captured along with metadata for later searching, a la xkeyscore.

I don't think people would be calling for this level of punitive fines if Zoom were a Silicon Valley company making misleading claims.

Fun fact, Zoom is a Silicon Valley company making misleading claims. It was started in California originally, not China.

> If Zoom made clear to users that connections were not secured to the same standards as competitors…

Which competitors offered true E2E?

I think mostly they were (misleadingly/lyingly) promissing something above what most of their competitors offered, no?

I don't think anyone except crypto-nerds cares about this. Normal people just assume everything can be wiretapped and Zuckerberg and friends are always listening.

Sure, that sounds like fair solution.

But that's not how capitalism works.

You can be honest business or you can steal billions, get caught and pay a millions in fines. I think everyone can see a problem here. You pay back less then you stole so this is an active encouragement to steal.

Most recent example, morgan stanley fraud for bilions in profit pays fine of 1.5 mil [0].

Reality is borrowing from Kafka.

[0] https://coinweek.com/bullion-report/morgan-stanley-mitsubish...

Reply on news.ycombinator.com